APM: OAUTH2 JWT Token with groups claim

Create Claime `groups` with value, set type `custom`: 

[%{session.user.custom.memberOf}]

Create iRule and assingn it to the VS with your Access Policy:

# memberOf String Example: "| CN=RedGroup_Name,OU=_Groups,DC=example,DC=com | CN=GreenGroup_Name,OU=_Groups,DC=example,DC=com | ..."
when  ACCESS_POLICY_AGENT_EVENT {
    if {[ACCESS::policy agent_id] eq "memberOfCustomization"} {
        
        set result {}
        set pattern "Any Group's Filter Pattern"
        # Get All User's Groups from the Session Var (String)
        set memberOf [ACCESS::session data get "session.ldap.last.attr.memberOf"]
        # Get List of "canonicalName" Strings
        set groups [regexp -all -inline "CN=.*?(?=,)" $memberOf]
        foreach elem $groups {
            # Get Groups by Pattern
            if {[string first $pattern $elem] != -1} {
                # Replace 'CN=' to Nothing and Append Group to the 'result' List
                append result \"[regsub "CN=" $elem ""]\",
            }
        }
        ACCESS::session data set session.user.custom.memberOf $result
    }
}

Inside your Access Policy add `iRule Event` block with `memberOfCustomization` EventID before your `OAuth Authorization` block.
APM ver 16.1.0
Hope it will be helpful 🙂

Solution provided by F5 

OAUTH2 JWT Token with custom groups claim (f5.com)

Hi Daniel, I am looking for something similar as well that F5 should provide JWT wherin we have the claims (attributes) values. I ma new to this but I used the guided config and setup F5 as the authorization server, with Postman I can succesfully retrieve the access token and refresh token. I configured the claims in the application on the F5.

How do I actually retreive those values from F5, do I have to provide the access token to F5 as authorization header to be able to retreive this information or should it already be included shile receiving the access token? How to verify this with Postman (I am lacking oauth test APP). Could you eleborate on this and what about this RFE is this fixed now? Thanks a lot

Bump! Same question on my side, this is actually a mandatory feature.

Any possibility to do json arrays / lists in a claim?

Thanks!

Bump! Same question on my side, this is actually a mandatory feature.

Any possibility to do json arrays / lists in a claim?

Thanks!